Privacy policy

This is the personal website of Aniq Najmuddin. I run it myself, on my own hardware, and I collect as little data about visitors as I can. This page explains exactly what is collected, why, how long it is kept, and what you can ask me to do with it.

Who is responsible

Aniq Najmuddin, based in Selangor, Malaysia. Contact: hello@novafortress.my.

Where the site runs

The website, its database and its files run on a network storage server in my home in Selangor, Malaysia. Traffic reaches it through Cloudflare, which acts as the network provider and protects the site from abuse. Cloudflare processes technical request data, such as your IP address, to deliver the site.

The “How this page reached you” panel

The home page shows the country Cloudflare detected for your connection and the Cloudflare data centre that served you. Both come from headers Cloudflare adds to each request. They are only shown to you on that page and are not stored or logged by this site.

Visit statistics

I count page views with my own privacy-friendly analytics. They set no cookies, store nothing in your browser and use no third-party analytics service. For each page view, the server records:

• the page address you visited (without any query string),
• the domain of the site that linked you here, if any,
• your country, as reported by Cloudflare,
• your device type: mobile, tablet or desktop,
• an anonymous visitor code made from your IP address, your browser and a secret that changes every day. The code cannot be reversed to get your IP address, and it changes daily, so visits cannot be linked across days.

I use these numbers to see which pages and blog posts are read and where readers come from. Your IP address itself is not stored. If your browser sends a Do Not Track or Global Privacy Control signal, no page views are recorded at all. Known bots are also ignored.

Contact form

When you send a message, I store your name, email address, the topic you chose (with the few words about it, if you add them) and your message so I can read it and reply. I receive a notification about it by email and on my phone. I use these details only to reply to you. I do not add you to any mailing list, and I do not share your message with anyone.

I may switch on an automatic confirmation that your message arrived. If it is on, each address receives at most one confirmation every 30 days.

Email conversations

My emails are sent through Brevo, an email delivery service, which processes your email address to deliver them. If you reply, or email one of this site’s addresses directly, Cloudflare Email Routing forwards the email to my inbox and passes a copy to this site, so the conversation is kept together in one place. If I write to you first from this site, for example about a role, the conversation is stored the same way.

Attachments you send stay in my inbox. This site only keeps a note of their names and sizes. Files I attach to my own emails are kept only until the email is sent.

Cloudflare checks whether an email really comes from the address it claims (SPF, DKIM and DMARC), and this site stores the result to warn me about forged emails. If I mark messages from an address as spam and block it, I keep that address on a block list so later messages from it are filtered out.

Resume and CV requests

My resume page and resume PDF are public and contain no private details. My full CV, which includes my phone number and references, is only sent on request. If you request it, I store your name, email address, organisation and optional message, and I review the request myself. Nothing is sent to you unless I approve it. If I do, or if I send you my CV link in a conversation, you receive a private link that expires after a limited time (two weeks unless I set otherwise), and the site records how often and when it was opened.

Blog emails

If you subscribe to new posts, I store your email address, the topics you chose (or that you want every post), and when you subscribed and confirmed. The subscription only starts once you click the link in the confirmation email. If you never click it, your address is deleted after 7 days.

When I publish a post, I can send it to subscribers once, from my own domain through Brevo. These emails contain no tracking: I don’t record whether you open them or what you click. Every email has a link to choose topics or unsubscribe, and mail apps that support it also show their own unsubscribe button. Unsubscribing deletes your address straight away.

Security records

Every attempt to sign in to the admin area of this site is recorded with the IP address, country and type of browser, so I can spot and block break-in attempts.

How long data is kept

• Messages and email conversations: deleted automatically 12 months after the last email, or sooner if I delete them.
• Anything I delete: removed for good after 30 days in the trash.
• CV requests: 6 months.
• The record of emails the site sent: 6 months.
• Page view records: 12 months.
• Admin sign-in records: 90 days.
• Blog subscriptions: until you unsubscribe. Sign-ups that are never confirmed: 7 days.
• The record of which posts were emailed to you: 6 months.
• Files I attach to emails: until the email is sent.
• Blocked addresses: until I unblock them.

Backups of the server can hold copies for a short while longer, until they are replaced.

Who else handles your data

• Cloudflare: network, security and email routing (privacy policy).
• Brevo: sending emails (privacy policy).
• Notifications to my own phone and computer go through the browser makers’ push services. Their content is end-to-end encrypted, so those services cannot read it.

Nothing is sold, and nothing is used for advertising.

Cookies

Public pages set no cookies. The only cookie on this site is a login cookie that only I use, for the admin area. If you choose a light or dark theme, that choice is saved in your own browser storage and is never sent to the server.

Your rights

You can ask me to tell you what I hold about you, to correct it, or to delete it. Email hello@novafortress.my and I will respond within 21 days, in line with the Personal Data Protection Act 2010 of Malaysia. Visit statistics are anonymous, so I cannot link them to you.

Changes

If this policy changes, the date at the top of this page will change too.